FTC Releases Annual Privacy and Data Security Update

The Federal Trade Commission today released its annual report summarizing its privacy and data security work in 2017. The Commission is the nation’s primary privacy and data security enforcer and one of the most active privacy and data security enforcers in the world.

The FTC uses a variety of tools to protect consumers’ privacy and personal information including bringing enforcement actions to stop law violations and require companies to take affirmative steps to remediate the unlawful behavior. Among the FTC’s privacy and security actions announced in 2017 include settlements with computer manufacturer Lenovo and Vizio, one of the world’s largest makers of smart TVs. In addition, the FTC in 2017 brought its first actions enforcing the EU-U.S. Privacy Shield framework.

The FTC also issues reports, conducts research and holds events bringing together stakeholders to discuss emerging issues in consumer privacy and security. The FTC’s 2017 events included workshops examining the security and privacy issues related to connected cars, student privacy and education technology, the changing nature of identity theft, and informational injury.

The Commission’s privacy accomplishments continue in 2018. This month, the FTC announced the agency’s first children’s privacy and security case involving connected toys against electronic toy maker VTech. The company agreed to pay $650,000 to settle allegations that it violated the Children’s Online Privacy Protection Act by collecting personal information from children without providing direct notice and obtaining their parent’s consent, and failing to take reasonable steps to secure the data it collected. Also in January, the FTC and the state of Nevada charged the parties responsible for revenge porn site MyEx.com with violating federal and state law by posting intimate images of people, together with their personal information, without their consent. One of the defendants agreed to a permanent ban on posting intimate images without consent. Finally, the Commission released a staff perspective detailing the key takeaways from the 2017 connected cars workshop. The Commission will also be hosting its third annual PrivacyCon event on February 28, 2018.